vpndetection-rails 2.0.11 → 2.0.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 212da0b891fcf091b7435cd63573d9f828cca9c1a3b69e8bda3b0d7c3238bdab
-  data.tar.gz: 94c10c18aa4f25dec95ffe8e89d92f203f9544e8c349f2562441f5c2e1f130e3
+  metadata.gz: 5d511872aa8a56af6ea3c30fb1eb836ed375675ea33a0b42034a2d2994fd0b5b
+  data.tar.gz: 6584b5f34d60360fa5238861dded3d02fd18b354294cb30f353a2d984c6e7d73
 SHA512:
-  metadata.gz: 315926ec3c3e853187f414f21dfa4782b7db61738500b9971fa148bb6d3a1637e01c1512863e8373272cf367ac2545d6fcd76e93f7ba90abd007c356453f82f6
-  data.tar.gz: 21854c3b4784d6f255db5aae81b03f13af63ac3a89bbf559a1b736eca28d2dba2129c7c5545317a8d53c1db3962522d6438a4c3bfd13674fc84c243d65c769c9
+  metadata.gz: d451eb799f2ff065469f7e04d4ea256304fd0779da596f89e6388f94c6da2dcd3505bb179d88f6b9053067ffe10348e7261cd1365b3910ef94ca6a6d9dc16266
+  data.tar.gz: f0eb5bc90e4e58172d99f12e71b27817c41677b205d80de1f143f8cc32ce50aabc3022dbb5dc37cf3fb73fda7b74e1481e21ac4b7a534ad1075dea9303779f7a

data/README.md

@@ -70,9 +70,9 @@ on_blocked: ->(request, lookup) { [303, { "location" => "/no-vpn" }, []] }
 
 This is the setting that decides whether any of the above works, and it is the one thing only you can get right.
 
-**In Rails**, the default reads `env["action_dispatch.remote_ip"]` — the answer `ActionDispatch::RemoteIp` computed from `X-Forwarded-For` minus your `config.action_dispatch.trusted_proxies`. That is the right fix behind a load balancer: tell Rails which proxies are yours and it resolves the visitor for you. `Rack::Request#ip` does *not* read that entry, so reading Rails' own is what makes your `trusted_proxies` mean anything here.
+**In Rails**, the default reads `env["action_dispatch.remote_ip"]` — the answer `ActionDispatch::RemoteIp` computed from `X-Forwarded-For` minus your `config.action_dispatch.trusted_proxies`. That is the right fix behind a load balancer: tell Rails which proxies are yours and it resolves the visitor for you. `Rack::Request#ip` does *not* read that entry, so reading Rails' own is what makes your `trusted_proxies` mean anything here. **With nothing in front of the app server, that default can be forged**: `RemoteIp` believes `X-Forwarded-For` without checking that the connection came from a proxy, so any visitor picks the address that gets looked up. There, pass `ip_selector: ->(request) { request.ip }`.
 
-**In a bare Rack app** there is no such entry and the default falls back to `Rack::Request#ip`. Be aware that Rack's `ip` **already trusts `X-Forwarded-For`**: it returns the left-most entry once private and loopback addresses are dropped, which is whatever the caller sent. That is measured, not assumed, and the test suite pins it. Behind nothing, or behind an edge that appends rather than overwrites, name your edge's header instead:
+**In a bare Rack app** there is no such entry and the default falls back to `Rack::Request#ip`. Rack's `ip` returns the connecting address, `REMOTE_ADDR`, unless that is a trusted proxy, which by default means a loopback or private address. Only then does it read `X-Forwarded-For`, and it takes the right-most entry that is not a trusted proxy. The test suite pins both. Behind an edge on a public address, or one that appends rather than overwrites, name your edge's header instead:
 
 ```ruby
 ip_selector: VPNDetection::Rails.header_ip_selector("CF-Connecting-IP")

data/lib/vpndetection/rails/version.rb

@@ -2,6 +2,6 @@
 
 module VPNDetection
   module Rails
-    VERSION = '2.0.11'
+    VERSION = '2.0.12'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: vpndetection-rails
 version: !ruby/object:Gem::Version
-  version: 2.0.11
+  version: 2.0.12
 platform: ruby
 authors:
 - Mslm Dev
@@ -29,7 +29,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 5.6.2
+        version: 5.6.3
     - - "<"
       - !ruby/object:Gem::Version
         version: '6'
@@ -39,7 +39,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 5.6.2
+        version: 5.6.3
     - - "<"
       - !ruby/object:Gem::Version
         version: '6'